Threats tagged 'ghsa-g4vf-4v95-x4pc'

A vulnerability in Thunderbird on Windows allows bypassing a security check that prevents mailbox: URLs from accessing files on remote Windows network shares by using extended-length UNC paths. This can cause Thunderbird to connect to an attacker-controlled SMB server, leaking the user's Windows account name and NTLM authentication data. The leaked NTLM data could be used for offline password cracking or relay attacks. This issue affects only Thunderbird on Windows and was fixed in Thunderbird versions 159 and 153.6.